AIKIDO-2026-254626
net-ssh is vulnerable to Authentication Bypass
81
High Risk
This Affects:
net-sshTL;DR
Net::SSH::HostKeyEntries::CertAuthority#matches_key? accepts any server certificate signed by a trusted @cert-authority key, checking only the signature and that the signing key matches the stored CA key. It never checks valid_principals against the connecting host, the certificate validity window, the certificate type, or critical_options. A certificate issued for a different host, an expired certificate, or even a user certificate from the same CA authenticates the server, letting that certificate's holder impersonate any host trusting the CA and capture the resulting session. The fix checks the principal, validity, type, and critical options and raises HostKeyMismatch so permissive verifiers can no longer accept or cache a rejected certificate.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you trust SSH host certificates through @cert-authority entries in known_hosts.
Background info
net-ssh is vulnerable to Authentication Bypass in versions 6.3.0 - 7.3.3.
How to fix this
Upgrade the net-ssh library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.